Repository navigation
libxi 1.8.4, libxtst 1.2.6: X.Org client-lib advisory (11 CVEs) - #920
bryan-minimal wants to merge 1 commit into
Conversation
…ry 2026-10-16) libxi 1.8.4 fixes CVE-2026-93541..93545, CVE-2026-94281, CVE-2026-94282, CVE-2026-109089, CVE-2026-109090. libxtst 1.2.6 fixes CVE-2026-94286 and CVE-2026-109088. Advisory: https://lists.x.org/archives/xorg-announce/2026-October/003752.html Source URL points at the upstream xorg.freedesktop.org archive instead of the gs://minimal-staging-archives mirror: the pkgmgr updater cannot resolve these two packages (no upstream-source override), so it could not mirror them. sha256 matches the signed release announcements. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 2 billable files and costs up to $0.50.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 26 minutes for your next included review. View limit details
📒 Files selected for processing: 2
Comment |
|
Superseded: X.org lib version tracking (minimal-supply-chain#520, pkgmgr-rs#997) is now deployed, so the updater can produce this bump itself, with the tarballs mirrored to gs://minimal-staging-archives instead of pointing at xorg.freedesktop.org. Replacement PR follows from the updater. 🤖 Generated with Claude Code |
libxi 1.8.3 → 1.8.4, libxtst 1.2.5 → 1.2.6
Manual bump: the updater can't handle these two packages (see Why manual below). Companion to #917 (libx11 1.8.14 + libxrender 0.9.13, cut by the updater), from the same X.Org advisory.
.tar.xz)1.8.31.8.4ddd6057b89a91903bc2f884d55c8467440906945e482c36547260dff28661afc1.2.51.2.6f94f0b37c07d80d877f3eda2c2405cc7e62aa9842f6310354aa349e3d66a4fe5Both SHA256 and SHA512 match the signed release announcements (libXi 1.8.4, libXtst 1.2.6). The new
configure.acdependency lists (x11 xext xfixes inputproto/x11 xext xi recordproto) match the deps the recipes already declare.Security
Clears 11 CVEs from the X.Org client-library security advisory of 2026-10-16. NVD has not analysed them yet (no CPEs), so the scanner can't list them. Also, neither package emits a vuln query at all today (both are on the updater's "UNSCANNED" list).
libxi 1.8.3 → 1.8.4 (9 CVEs)
XQueryDeviceState(). A ValuatorClassnum_valuatorsvalue is trusted without checking it against the class length.size_classes()/copy_classes()) viaXIQueryDevicereplies orXI_DeviceChangedevents with inconsistent class lengths.num_classes, a zero or oversized per-class length, or button/key counts larger than the class bytes.XIQueryDevicereply parsing. Server-suppliedlength/num_buttons/num_keycodesare used unchecked.XListInputDevices(). A device-name length byte exceeding the remaining reply makesmemcpy()read past the buffer.XListInputDevices()class parsing.SizeClassInfo()never decrements the remaining size, so individually valid lengths can cumulatively run past the buffer.buttons_lenmakeswireToEnterLeave()copy past the event.XGetDeviceControl(). A control-type mismatch on a DEVICE_RESOLUTION reply leaves a tiny allocation while an unbounded valuator list is filled into it.XGetDeviceControl(). DEVICE_ENABLE is allocated at the wire length (8 bytes) but filled with a fullXDeviceEnableState(12 to 16 bytes).libxtst 1.2.5 → 1.2.6 (2 CVEs)
datum_bytesexceeding the reply hands the callback a pointer/length that runs past the buffer, so the client can crash or leak adjacent memory.parse_reply_call_callback(). A zero-progress RECORD EnableContext element hangsXRecordEnableContext()or livelocks Xlib.⚠ Why manual: mirror upload needed before merge
The source URL here is the upstream
https://xorg.freedesktop.org/archive/individual/lib/…archive. It is not thegs://minimal-staging-archivesmirror that every other X lib uses. The updater normally mirrors on PR creation, but it can't see these two packages:update --stacked … libxi=1.8.4 libxtst=1.2.6silently dropped both pins (total=2 skipped=0, no warning).check --package libxireportsno upstream source found. libxi and libxtst have no provenance and no entry in pkgmgr-rssrc/upstream_sources.rs's X.Org override table. The runner also setsPKGMGR_SKIP_REPOLOGY=true, so nothing resolves them. libx11/libxrender/libxext all have override entries; libxi/libxtst (and libxt) were added for chromium-bin after that table was written.Before merge: upload
libXi-1.8.4.tar.xzandlibXtst-1.2.6.tar.xztogs://minimal-staging-archives/(same SHA256 as above) and switch bothurls back togs://minimal-staging-archives/lib…-%{version}.tar.xz. Alternatively, merge as-is if an https source is acceptable for these two. The real fix is two override entries in pkgmgr-rs, so the nightly can track and mirror them from now on.Blast radius
Direct dependents. Both packages are pulled into the JVM bootstrap ladder:
libxi(21):libxtst,raylib,icedtea-7,icedtea-8,openjdk-9…openjdk-25libxtst(21):chromium-bin,chromium-headless-shell-bin,icedtea-7,icedtea-8,openjdk-9…openjdk-25Merging this together with #917 (or right after it) avoids rebuilding the ladder and chromium twice.
🤖 Generated with Claude Code